edh-keygen/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Added

• Added configurable ownership and permission defaults for the shared DH parameter directory and generated DH parameter files through tls_private_owner, tls_private_dir_mode, and tls_private_file_mode.
• Added configuration documentation for shared DH parameter access and for the distinction between DH parameters and TLS private keys.
• Added deterministic ownership and permission enforcement for the shared DH parameter directory and dh_*.pem files.

Changed

• Changed the default shared DH parameter directory ownership and mode to root:root and 0755.
• Changed the default shared DH parameter file ownership and mode to root:root and 0644.
• Changed the shared DH parameter defaults to allow non-root TLS services to traverse the directory and read DH parameter files.
• Changed global DH parameter synchronization to apply the configured ownership and file mode after transfer.

1.0.0 - 2026-09-06

Added

• Added configurable Diffie-Hellman parameter generation for one or more key sizes.
• Added global configuration options for temporary and persistent DH parameter directories.
• Added support for simple service definitions using the service:owner format.
• Added extended service definitions for per-service DH parameter deployment, destination ownership, and file permissions.
• Added support for both system-wide systemd services and per-user systemctl --user services.
• Added support for rootless container service units by executing user service actions with the configured service owner and XDG_RUNTIME_DIR.
• Added systemd state inspection through LoadState, ActiveState, SubState, and Type.
• Added automatic restart of active units after a successful optional service-specific DH parameter synchronization.
• Added automatic execution of inactive or failed Type=oneshot units after a successful DH parameter update.
• Added explicit validation and error reporting for missing users, missing units, unavailable user managers, incomplete service definitions, missing DH files, and failed file operations.
• Added secure, explicit ownership and permission handling for created target directories and deployed DH parameter files.
• Added cleanup and failure handling for temporary DH parameter files and the global synchronization step.

Changed

• Changed service handling so that service-specific DH parameters are deployed before a service is restarted or a one-shot unit is started.
• Changed unit validation to distinguish missing services from inactive, failed, active, and transitional unit states.
• Changed reporting for per-user services to show the configured owner consistently for both status checks and service actions.
• Changed configuration parsing to preserve compatibility with user.group ownership syntax while converting it to user:group for chown.

Fixed

• Fixed misleading success messages for services that do not exist on a host.
• Fixed the possibility of creating or synchronizing DH parameters to a configured target path when the corresponding systemd unit is missing.
• Fixed malformed error-handling blocks around destination-directory creation and DH parameter copy operations.
• Fixed validation of the configured user.group ownership field.
• Fixed user-service restart handling so that active systemctl --user services are restarted as their configured owner.
• Fixed handling of active Type=oneshot units with SubState=exited by using ActiveState for action decisions.